Kmart Hack Spawns Data Breach Class Action Lawsuit

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A Kmart data breach class action lawsuit is just the latest to hit a retailer and involves hackers using a similar exploit to obtain credit card records for customers. However, the lead plaintiff is not a customer. It’s a bank.

First NBC Bank alleges that it has been negatively hampered by Kmart’s allegedly lax IT policies because it had to work with customers to close any accounts and cancel cards associated with affected accounts as well as work to assess whether or not there were any fraudulent charges. Had the retailer complied with standardized policies, the financial institution argues in the Kmart class action lawsuit, none of this would have been necessary.

The Kmart data breach class action lawsuit cites the Payment Card Industry Data Security Standards twelve-item checklist that includes the guideline to “[e]ncrypt transmission of cardholder data and sensitive information across open, public networks, … protect all systems against malware and regularly update anti-virus software or programs … [and] develop and maintain secure systems and applications.”

The plaintiffs argue that had Kmart been proactive, there would never have been an issue in the first place. Visa announced the potential use of the flaw hackers exploited in the data breach in 2009. More importantly as retailers like Target and Home Depot were hit, the data breach class action lawsuit alleges the Kmart should have been aware that it faced the same problem in protecting records of credit card transactions that consumers made.

The bank is seeking damages based on the cost of “notifying customers of issues related to the Kmart data breach, closing out and opening new customer accounts, reissuing customers cards and/or refunding customers losses resulting from the unauthorized use of their accounts.” According to the data breach class action lawsuit, Kmart was bound by regulations to protect this data. Even if it was unable to do so, the plaintiffs note that it took more than five weeks for the retailer to notify consumers as well as financial institutions, exacerbating the problems that the bank faced in trying to repair their customers credit card and debit card accounts.

First NBC Bank is seeking to represent a putative Class of “All Financial Institutions—including, but not limited to, banks and credit unions—in the United States (including its Territories and the District of Columbia) that issue payment cards, including credit and debit cards, or perform, facilitate, or support card issuing services, whose customers made purchases from Kmart stores from Sep. 1, 2014 to Oct. 9, 2014” on counts of violations of Illinois state business and consumer protection statutes, negligence and negligent misrepresentation.

First NBC Bank is represented by class action lawyers from Miller Law LLC, Murray Law Firm, Carlson Lynch Sweet & Kilpela LLP and Lockridge Grindal Nauen PLLP.

The Kmart Data Breach Class Action Lawsuit is First NBC Bank v. Kmart Corp., et al., Case No. 1:14-cv-10088, in the U.S. District Court for the Northern District of Illinois.